This vulnerability affects the Oracle Communications Billing and Revenue Management product (component: Platform) in versions 15.0.0.0.0-15.0.1.0.0 and 15.1.0.0.0-15.2.0.0.0. It is easily exploitable by a low privileged attacker who has logon access to the infrastructure where the product runs. Successful exploitation can lead to full compromise and takeover of the Oracle Communications Billing and Revenue Management system. The CVSS 3.1 vector indicates local attack vector (AV:L), low attack complexity (AC:L), low privileges required (PR:L), no user interaction (UI:N), unchanged scope (S:U), and high impacts on confidentiality (C:H), integrity (I:H), and availability (A:H). The vulnerability is classified under CWE-269 (Improper Privilege Management). Oracle’s July 2026 Critical Patch Update advisory references this vulnerability but does not explicitly confirm patch availability or remediation status for this specific issue.

The vulnerability allows an attacker with low privileges and logon access to the affected infrastructure to compromise Oracle Communications Billing and Revenue Management fully. This can result in complete system takeover, affecting confidentiality, integrity, and availability of the system. The high CVSS score reflects the critical nature of the impact on the affected product.

Oracle has included this vulnerability in its July 2026 Critical Patch Update advisory. However, the advisory does not explicitly confirm the availability of a specific patch or remediation for this vulnerability. Customers are strongly advised to review the Oracle Critical Patch Update advisory at https://www.oracle.com/security-alerts/cpujul2026.html for the latest patch availability and installation instructions. Applying the latest security patches from Oracle promptly is recommended to mitigate this and other vulnerabilities. Until a patch is confirmed, restrict access to the infrastructure hosting Oracle Communications Billing and Revenue Management to trusted users only.